{"uuid": "4a908189-beec-4b88-865c-bc8160937e5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26134", "type": "exploited", "source": "https://t.me/hacking_Attack/55970", "content": "Black Hat Ethical Hacking\nCritical Atlassian Confluence zero-day actively used in attacks\n\nCritical Atlassian Confluence zero-day actively used in attacksPost Views: 18 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nHackers are actively exploiting a new Atlassian Confluence zero-day vulnerability tracked as CVE-2022-26134 to install web shells, with no fix available at this time.\nToday, Atlassian released a security advisory\u00a0disclosing that CVE-2022-26134 is a critical unauthenticated, remote code execution vulnerability tracked in both Confluence Server and Data Center.\n\nAtlassian says that they confirmed the vulnerability in Confluence Server 7.18.0 and believe that Confluence Server and Data Center 7.4.0 and higher are also vulnerable.\n\nThe advisory warns that threat actors are actively exploiting Confluence Server 7.18.0.\n\nAs there are no patches available, Atlassian\u00a0is telling customers to make their servers inaccessible by one of these two methods:\n\n* \nRestricting Confluence Server and Data Center instances from the internet.\n\n* \nDisabling Confluence Server and Data Center instances.\nThere are no other ways to mitigate this vulnerability.\n\nOrganizations that use Atlassian Cloud (accessible via atlassian.net) are unaffected by this vulnerability.\n\nAtlassian is actively working on a patch and will release further information in their advisory when it becomes available.\n\nThe Cybersecurity and Infrastructure Security Agency (CISA) has added this zero-day to its \u2018Known Exploited Vulnerabilities Catalog\u2018\u00a0 and is requiring federal agencies to block all internet traffic to Confluence servers by tomorrow, June 3rd.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Servers exploited for initial accessIn a coordinated disclosure, cybersecurity firm Volexity explained that the vulnerability was discovered over the Memorial Day weekend while performing incident response.\n\nAfter conducting the investigation, Volexity could reproduce the exploit against the latest Confluence Server version and disclosed it to Atlassian on May 31st.\n\n\u201cAfter a thorough review of the collected data, Volexity was able to determine the server compromise stemmed from an attacker launching an exploit to achieve remote code execution,\u201d explains a blog post\u00a0by Volexity.\n\n\u201cVolexity was subsequently able to recreate that exploit and identify a zero-day vulnerability impacting fully up-to-date versions of Confluence Server.\u201d\n\nIn the breach analyzed by Volexity, threat actors installed BEHINDER, a JSP web shell that allows threat actors to execute commands on the compromised server remotely.\nSee Also: Malicious PyPI package opens backdoors on Windows, Linux, and Macs See Also: Offensive Security Tool: Arjun The threat actors then used BEHINDER to install the China Chopper web shell and a simple file upload tool as backups.\n\nFrom Volexity\u2019s investigation, the threat actors dumped the user tables of the Confluence server, wrote additional webshells, and altered access logs to evade detection.\n\nVolexity says that they believe the multiple threat actors from China are utilizing these exploits.\n\nAs there are no patches available, Volexity also recommends that Confluence admins disconnect their servers from the Internet until Atlassian releases a fix.\n\nVolexity has released a list of IP addresses\u00a0behind the attacks and Yara rules\u00a0to identify web shell activity on Confluence servers. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security,[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T19:00:03.646135Z"}